Add polling config and restart orchestration for OBA#307
Closed
sehkone wants to merge 3 commits into
Closed
Conversation
OpenBao Agent only renders KV v2 templates once at startup unless template_config.static_secret_render_interval is set. Add the block with a 5-minute interval so agents re-check KV for changes. Rotation now follows write-KV → restart-OBA → poll-rendered-file → restart-service, ensuring secrets are rendered before the dependent service restarts. Dead helpers (write_ca_json_dsn, build_responder_config, update_responder_hmac) removed since OBA handles file rendering. Closes #301
Prevent secret_id file deletion after first read by setting remove_secret_id_file_after_reading = false in the auto_auth config. Without this, OBA cannot re-authenticate after a container restart because the secret_id file no longer exists. Mount the responder config directory instead of the file in the Docker compose override. When OBA atomically renders templates (write temp + rename), the file gets a new inode. Docker file bind mounts track inodes, so the container keeps seeing stale content. Directory mounts avoid this problem. Refs #301
With a 5-minute static_secret_render_interval, OpenBao Agent defers re-rendering by up to 5 minutes after container restart. This causes the 60-second wait_for_rendered_file timeout to expire in CI before the template is updated with the new secret value. Reducing to 30s ensures OBA re-renders within the polling window. Also add OBA agent log capture to E2E failure artifacts for easier diagnosis of future failures. Refs #301
Contributor
Author
|
Superseded by combined PR |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
template_config { static_secret_render_interval = "5m" }to OpenBao Agent HCL so KV v2 static secrets are re-polled periodicallywrite_ca_json_dsn,build_responder_config,update_responder_hmac) since OBA now handles file renderingerror_rendered_file_timeouti18n message (EN/KO)Test plan
wait_for_rendered_file(immediate success + timeout)template_configblock in HCL output./tests/docker/run-e2e.sh main-lifecycle./tests/docker/run-e2e.sh rotation-recoveryCloses #301